Privacy policy

1. Identification of the data controller

Zyvean (the “Controller”), domiciled in Bogotá D.C., Cundinamarca, Colombia, acts as the controller of the personal data collected through the website zyvean.com and its associated communication channels.

Data subject service channel: hello@zyvean.com. This channel is the area responsible for handling petitions, inquiries and claims referred to in Article 2.2.2.25.3.1(f) of Decree 1074 of 2015.

2. Legal framework

This policy is governed by the following provisions, and by any that amend, supplement or replace them:

• Articles 15 and 20 of the Colombian Constitution (fundamental right of habeas data).
• Statutory Law 1581 of 2012, which sets out general provisions for the protection of personal data.
• Decree 1377 of 2013 and Decree 886 of 2014, compiled in Sole Regulatory Decree 1074 of 2015, Book 2, Part 2, Title 2, Chapters 25 and 26.
• Sole Circular of the Superintendence of Industry and Commerce (SIC), Title V.
• Constitutional Court case law, in particular Judgment C-748 of 2011.

3. Definitions

For the purposes of this policy, and in accordance with Article 3 of Law 1581 of 2012 and Article 2.2.2.25.1.3 of Decree 1074 of 2015:

• Authorization: the data subject's prior, express and informed consent to the processing of their personal data.
• Privacy notice: a verbal or written communication informing the data subject of the existence of this policy, how to access it and the purposes of the processing.
• Database: an organized set of personal data subject to processing.
• Personal data: any information linked or linkable to one or more identified or identifiable natural persons.
• Public data: data that is not semi-private, private or sensitive, such as data on a person's civil status or profession.
• Sensitive data: data affecting the data subject's privacy or whose misuse may lead to discrimination.
• Processor: a natural or legal person who processes personal data on behalf of the controller.
• Controller: a natural or legal person who decides on the database and its processing.
• Data subject: the natural person whose personal data is processed.
• Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• Transfer: the sending of personal data by the controller or processor to a recipient who is itself a controller, inside or outside the country.
• Transmission: the communication of personal data inside or outside the national territory so that a processor may process it on behalf of the controller.

4. Guiding principles

Processing is subject to the principles of legality, purpose limitation, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality set out in Article 4 of Law 1581 of 2012. Accordingly, the Controller collects only data that is adequate, relevant and not excessive in relation to the stated purposes, and does not commercialize personal data in any form.

5. Data processed

The Controller processes the following categories of personal data, of a public, semi-private or private nature:

• Identification and contact data: name, email address and phone number, provided by the data subject when requesting a meeting.
• Corporate data: company, position and operational information the data subject voluntarily shares about their organization.
• Correspondence data: email address and the content of messages sent to the Controller.
• Browsing data: technical information collected through Google Analytics 4, only where the data subject accepts analytics cookies, as set out in the cookie policy.

6. Sensitive data and data of minors

The Controller does not request or process sensitive data within the meaning of Article 5 of Law 1581 of 2012. Data subjects are asked not to submit such data through free-text fields.

The site is intended for businesses and professionals. The Controller does not knowingly collect data from children or adolescents; should it do so, processing will comply with Article 7 of Law 1581 of 2012 and respect their best interests.

7. Purposes of processing

Personal data will be processed solely for the following purposes:

• Handling contact requests and scheduling, preparing and holding the meetings requested by the data subject.
• Sending confirmations, commercial proposals and follow-up communications about the services the data subject expressed interest in.
• Entering into, performing and managing any pre-contractual and contractual relationship between the parties.
• Producing aggregate statistical analyses of site usage to improve its content and performance.
• Responding to requests from competent authorities and complying with applicable legal obligations.

8. Data subject's authorization

Under Article 9 of Law 1581 of 2012, processing requires the data subject's prior, express and informed authorization. Such authorization is obtained through unequivocal conduct, such as completing and submitting the site's forms or voluntarily sending communications to the Controller, under Article 2.2.2.25.2.4 of Decree 1074 of 2015. The Controller will keep proof of the authorization granted.

Authorization is not required in the cases set out in Article 10 of Law 1581 of 2012.

Answers to the logistics assessment are processed locally in the data subject's browser and are not transmitted to, collected or stored by the Controller, and therefore do not constitute processing of personal data by it.

9. Storage, circulation and processors

Personal data provided by data subjects is stored in the Controller's own databases, administered directly by it, with access restricted to authorized personnel bound by confidentiality duties. The Controller does not sell, lease or assign personal data to third parties.

Google LLC acts as a processor solely with respect to browsing data collected through Google Analytics 4, following the data subject's acceptance of analytics cookies, and under its own terms and privacy policy (policies.google.com/privacy).

Data may be disclosed to public or administrative authorities acting within their legal powers, or by court order.

10. International transmission of data

Browsing data collected through Google Analytics 4 may be subject to international transmission to servers located outside Colombia, mainly in the United States of America. This transmission is made to a processor offering an adequate level of protection and is based on the express authorization the data subject grants by accepting analytics cookies, under Article 26 of Law 1581 of 2012 and Articles 2.2.2.25.5.1 et seq. of Decree 1074 of 2015.

11. Rights of data subjects

Under Article 8 of Law 1581 of 2012, the data subject has the right to:

• Know, update and correct their personal data held by the Controller, including partial, inaccurate, incomplete, fragmented or misleading data.
• Request proof of the authorization granted, except where it is not required under Article 10 of Law 1581 of 2012.
• Be informed, upon request, of how their personal data has been used.
• File complaints with the Superintendence of Industry and Commerce for breaches of the law, once the inquiry or claim process with the Controller has been completed, under Article 16 of Law 1581 of 2012.
• Revoke the authorization and/or request deletion of the data where processing does not respect constitutional and legal principles, rights and guarantees, provided there is no legal or contractual duty to remain in the database.
• Access, free of charge, their personal data that has been processed, at least once every calendar month and whenever this policy is materially amended.

12. Standing to exercise rights

Under Article 2.2.2.25.4.1 of Decree 1074 of 2015, rights may be exercised by the data subject, upon proof of identity; by their successors, upon proof of that status; by their representative or attorney, upon proof of representation or power of attorney; or by stipulation in favor of or for another.

13. Inquiry procedure

Under Article 14 of Law 1581 of 2012, the data subject or their successors may consult the personal information held in the Controller's databases by sending a request to hello@zyvean.com.

Inquiries will be answered within a maximum of ten (10) business days from receipt. Where this is not possible, the requester will be informed of the reasons for the delay and the date on which the inquiry will be answered, which may in no case exceed five (5) business days after the first term expires.

14. Claim procedure

Under Article 15 of Law 1581 of 2012, the data subject or their successors who consider that information should be corrected, updated or deleted, or who notice an alleged breach of any legal duty, may file a claim addressed to hello@zyvean.com, which must include the identification of the data subject, a description of the facts giving rise to the claim, a physical or electronic address for notices and any supporting documents.

If the claim is incomplete, the claimant will be asked to remedy it within five (5) days of receipt. If two (2) months elapse from the date of that request without the required information being provided, the claim will be deemed withdrawn. Once a complete claim is received, the legend “claim in process” and its reason will be entered in the database within two (2) business days, and kept until the claim is decided.

The maximum term to resolve a claim is fifteen (15) business days from the day after its receipt. Where this is not possible, the claimant will be informed of the reasons for the delay and the date on which it will be resolved, which may in no case exceed eight (8) business days after the first term expires.

15. Security measures

In furtherance of the security principle, the Controller adopts the technical, human and administrative measures necessary to secure records and prevent their alteration, loss, consultation, use or unauthorized or fraudulent access, including encryption of communications in transit, access control based on individual credentials and restriction of access to authorized personnel. In the event of a security incident affecting personal data, the Controller will notify the Superintendence of Industry and Commerce as required by applicable law.

16. Database validity and retention

Personal data will be processed for as long as reasonable and necessary to fulfil the purposes that justified its collection, under Article 2.2.2.25.2.8 of Decree 1074 of 2015. In particular, contact and meeting data will be retained while the business relationship subsists and for up to two (2) years from the last contact, unless a legal or contractual duty requires a longer period. Browsing data will be retained in Google Analytics for a maximum of fourteen (14) months.

Once the purposes have been fulfilled, the data will be deleted from the Controller's databases.

17. Effective date and amendments

This policy is effective from its publication date. Any material change to its content, in particular regarding the identification of the Controller or the purposes of processing, will be communicated to data subjects in a timely manner by publication on this site, stating the date of update and, where necessary, requesting new authorization, under Article 2.2.2.25.3.2 of Decree 1074 of 2015.